Back to Malware Drops
7196e59b0ebd891606d84f78ea8cc95c0a82ba237d342bfc9922368de4e18da3
MD53929ef392e1d0ee39c30ac974b2a9908
SSDEEP192:f2Bi6PgM8PvaA0Rj1veSS79YtGrwck3Pkfzh16zPE7AvqSzgVgIbcd7vjjB4C1v8:f2Bi6PgM8PvaA0Rj1vy7CmKwUPIgXdjS
File Typetext/x-script
Size11.7 KB
Sources3
Downloads0
First SeenJun 8, 2022
Last SeenJun 8, 2022
Download sample (.zip, password: infected)
Live malware — handle only in an isolated analysis environment.
Originating Attacks
Honeypot sessions that dropped this sample. Drop URLs are defanged; commands are shown verbatim and are not links.
- Dropped in this session (no command captured).Jun 8, 2022, 6:33:29 AMView attack session
- Dropped in this session (no command captured).Jun 8, 2022, 6:33:29 AMView attack session
- Dropped in this session (no command captured).Jun 8, 2022, 6:33:29 AMView attack session
Indicators of Compromise
Values are defanged (e.g. hxxp://, [.]) — not live links.
domain (2)
- a[.]oracleservice[.]top
- update[.]aegis[.]aliyun[.]com
ipv4 (9)
- 107[.]189[.]11[.]170
- 127[.]0[.]0[.]1
- 134[.]122[.]17[.]13
- 146[.]59[.]198[.]38
- 167[.]114[.]114[.]169
- 198[.]251[.]86[.]46
- 23[.]94[.]24[.]12
- 51[.]255[.]171[.]23
- 51[.]79[.]175[.]139
url (6)
- hxxp://198[.]251[.]86[.]46
- hxxp://a[.]oracleservice[.]top
- hxxp://update[.]aegis[.]aliyun[.]com/download/quartz_uninstall[.]sh
- hxxp://update[.]aegis[.]aliyun[.]com/download/quartz_uninstall[.]sh||curl
- hxxp://update[.]aegis[.]aliyun[.]com/download/uninstall[.]sh
- hxxp://update[.]aegis[.]aliyun[.]com/download/uninstall[.]sh||curl